Predictive service orchestration using threat modeling analytics

Patent metadata

Field	Value
Publication number	US-12293393-B2
Application number	US-202217664718-A
Country	US
Kind code	B2
Filing date	May 24, 2022
Priority date	May 24, 2022
Publication date	May 6, 2025
Grant date	May 6, 2025

Abstract

Provided is a computer-implemented method, system, and computer program product for predictive service orchestration using threat modeling analytics. A processor may identify a plurality of attributes of a client computing environment. The processor may collect threat modeling content for a plurality of vendor computing environments. The processor may analyze the threat modeling content for the plurality of vendor computing environments. The processor may compare the analyzed threat modeling content for the plurality of vendor computing environments with the plurality of attributes of the client computing environment. The processor may generate, based on the comparing, a client threat model for the client computing environment.

First claim

What is claimed is:

1. A computer-implemented method comprising:
causing, by a processor, a plurality of commands to be performed at a client computing environment having vendor storage systems, at least some of the vendor storage systems having different physical configurations than other ones of the vendor storage systems;
identifying, by the processor, a plurality of attributes of the vendor storage systems of the client computing environment;
collecting, by the processor over a network, threat modeling content relating to the plurality of commands performed on the vendor storage systems;
analyzing, by the processor and using natural language processing, the threat modeling content to identify one or more vulnerabilities associated with one or more vendor storage systems of the vendor storage systems;
comparing, by the processor, the analyzed threat modeling content with the plurality of attributes of the client computing environment;
identifying, by the processor and based on the comparing, one or more security gaps associated with the client computing environment;
generating, by the processor and based on the identifying, a client threat model for the client computing environment;
generating, by the processor, a ranking value for the client threat model, wherein the ranking value is based in part on a confidence level between the client threat model and the threat modeling content;
comparing, by the processor, the ranking value to an orchestration threshold;
causing changes to be made to one or more of the plurality of attributes of the client computing environment in response to the ranking value not meeting the orchestration threshold;
in response to the changes being made to the one or more attributes, re-evaluating the client threat model; and
orchestrating, by the processor and in response to the ranking value meeting the orchestration threshold, at least one container of the client computing environment based on the client threat model.

2. The computer-implemented method of claim 1 , further comprising:
in response to the changes being made to the one or more attributes, dynamically adjusting, by an orchestration manager, system resources consumed by the client threat model under a pre-defined threshold.

3. The computer-implemented method of claim 2 , further comprising:
in response to the changes made to the one or more attributes causing a security threat to be mitigated, incrementing the ranking value.

4. The computer-implemented method of claim 2 , further comprising, in response to re-evaluating, by the processor and based on the changes to at least one attribute, the client threat model:
generating, by the processor, a second ranking value for the client threat model; comparing, by the processor, the second ranking value to the orchestration threshold; and
orchestrating, by the processor and based on the orchestration threshold being met, at least one container of the client computing environment.

5. The computer-implemented method of claim 4 , further comprising:
increasing, by the processor and based on a security test, threat resources to reduce severity of at least one security threat.

6. The computer-implemented method of claim 1 , further comprising:
identifying, by the processor and in response to the ranking value not meeting the orchestration threshold, at least one security threat associated with the client computing environment based on the client threat model;
generating, by the processor, a vulnerability score for the at least one security threat associated with client computing environment;
comparing by the processor, the vulnerability score for the at least one security threat to a vulnerability threshold; and
implementing, by the processor and in response to the vulnerability score meeting the vulnerability threshold, a security test for the at least one security threat.

7. The computer-implemented method of claim 1 , further comprising:
sharing, by the processor, the client threat model with at least one vendor.

8. The computer-implemented method of claim 1 , wherein an attribute of the plurality of attributes of the client computing environment is selected from a group of attributes consisting of:
component attributes;
configuration attributes;
workload attributes; and
setup attributes.

9. The computer-implemented method of claim 1 , wherein the threat modeling content includes workloads.

10. A system comprising:
a processor; and
a computer-readable storage medium communicatively coupled to the processor and storing program instructions which, when executed by the processor, cause the processor to perform a method comprising:
identifying a plurality of attributes of vendor storage systems of a client computing environment in response to a plurality of commands being performed at the client computing environment, wherein at least some of the vendor storage systems have different physical configurations than other ones of the vendor storage systems;
collecting, over a network, threat modeling content relating to the plurality of commands performed at the vendor storage systems;
analyzing, using natural language processing, the threat modeling content to identify one or more vulnerabilities associated with one or more vendor storage systems of the vendor storage systems;
identifying one or more security gaps associated with the client computing environment by comparing the analyzed threat modeling content with the plurality of attributes of the client computing environment;
generating, based on the identifying, a client threat model for the client computing environment;
generating, by the processor, a ranking value for the client threat model, wherein the ranking value is based in part on a confidence level between the client threat model and the threat modeling content;
comparing, by the processor, the ranking value to an orchestration threshold;
orchestrating, by the processor and in response to the ranking value meeting the orchestration threshold, at least one container of the client computing environment based on the client threat model;
causing changes to be made to one or more of the plurality of attributes of the client computing environment in response to the ranking value not meeting the orchestration threshold;
in response to the changes being made to the one or more attributes, re-evaluating the client threat model; and
in response to the changes made to the one or more attributes causing a security threat to be mitigated, incrementing the ranking value.

11. The system of claim 10 , wherein the method performed by the processor further comprises:
identifying, in response to the ranking value not meeting the orchestration threshold, at least one security threat associated with the client computing environment based on the client threat model;
generating a vulnerability score for the at least one security threat associated with client computing environment;
comparing the vulnerability score for the at least one security threat to a vulnerability threshold; and
implementing, in response to the vulnerability score meeting the vulnerability threshold, a security test for the at least one security threat.

12. A computer program product comprising a computer-readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to perform a method comprising:
identifying a plurality of attributes of vendor storage systems of a client computing environment in response to a plurality of commands being performed at the client computing environment, wherein at least some of the vendor storage systems have di

Assignees

• IBM

Inventors

• Ali Asmahan
• Mah Mustafa
• Jain Abhishek
• Eda Sasikanth

Classifications

• G06Q30/0609 Primary

  Qualifying participants for shopping transactions (payment transaction verification G06Q20/401) · CPC title